feat(hub): replace reCAPTCHA with a self-hosted proof of work

Sign-up and passphrase reset sent every visitor's address and browser
details to Google, which needed a consent the sign-up form could not ask
for freely. The hub now issues its own challenge (ALTCHA's scheme, signed
with a key derived from the hub's private key, single-use, 30 minutes)
and the page solves it with SubtleCrypto while the form is filled in.

- GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off.
- [captcha] enabled / max_number replace site_key / secret_key, which are
  now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old
  variables.
- No Google origin left in the CSP of the hub, the desktop shell or the
  Android shell; captcha_site_key leaves /v1/hub/info.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 6 insertions, 6 deletions

diff --git a/packages/meshbay-hub/tests/test_security_headers.py b/packages/meshbay-hub/tests/test_security_headers.py
index b068656..e6d431e 100644
--- a/packages/meshbay-hub/tests/test_security_headers.py
+++ b/packages/meshbay-hub/tests/test_security_headers.py
@@ -64,12 +64,12 @@ def test_the_policy_is_locked_down_where_it_matters():
     assert "https:" not in script.split()
 
 
-def test_recaptcha_is_the_only_external_origin():
-    hosts = {"https://www.google.com", "https://www.gstatic.com"}
+def test_no_external_origin():
+    """The sign-up check is the hub's own proof of work, not a third party's."""
     for part in CSP.split(";"):
         for tok in part.strip().split()[1:]:
-            if tok.startswith(("http://", "https://")):
-                assert tok in hosts, f"unexpected external origin in CSP: {tok}"
+            assert not tok.startswith(("http://", "https://")), (
+                f"external origin in CSP: {tok}")
 
 
 def test_the_streamed_download_frame_is_allowed():
@@ -78,8 +78,8 @@ def test_the_streamed_download_frame_is_allowed():
 
     The streamed-download path works by navigating a hidden iframe to
     `/_mbdl/<id>` so the service worker is asked for the response it is already
-    holding. `frame-src` was tightened to reCAPTCHA's two origins when the
-    captcha needed a frame, and nobody connected the two: Chrome refused the
+    holding. `frame-src` was tightened to a third-party captcha's two origins
+    when it needed a frame, and nobody connected the two: Chrome refused the
     frame, the worker was never asked, and the page waited out its timeout for
     a download that could not happen. On Firefox and Safari that is the *only*
     way to write a large file to disk — there is no File System Access API and